Struct Minijail

pub struct Minijail {
    pub(crate) jail: *mut minijail,
    pub(crate) disable_multithreaded_check: bool,
    pub(crate) log_fd: Option<(OwnedFd, i32)>,
}

Configuration to jail a process based on wrapping libminijail.

Intentionally leave out everything related to minijail_run. Forking is hard to reason about w.r.t. memory and resource safety. It is better to avoid forking from rust code. Leave forking to the library user, who can make an informed decision about when to fork to minimize risk.

Examples

• Load seccomp policy - like “minijail0 -n -S myfilter.policy”

      let mut j = Minijail::new().map_err(|_| ())?;
      j.no_new_privs();
      j.parse_seccomp_filters("my_filter.policy").map_err(|_| ())?;
      j.use_seccomp_filter();
      unsafe { // `fork` will close all the programs FDs.
          j.fork(None).map_err(|_| ())?;
      }

• Keep stdin, stdout, and stderr open after jailing.

      let j = Minijail::new().map_err(|_| ())?;
      let preserve_fds: Vec<RawFd> = vec![0, 1, 2];
      unsafe { // `fork` will close all the programs FDs.
          j.fork(Some(&preserve_fds)).map_err(|_| ())?;
      }

Errors

The fork function might not return an error if it fails after forking. A partial jail is not recoverable and will instead result in killing the process.

Fields

jail: *mut minijail

disable_multithreaded_check: bool

log_fd: Option<(OwnedFd, i32)>

Implementations

impl Minijail

pub fn new() -> Result<Minijail, Error>

Creates a new jail configuration.

pub fn try_clone(&self) -> Result<Minijail, Error>

Clones self to a new Minijail. Useful because fork can only be called once on a Minijail.

pub fn change_uid(&mut self, uid: u32)

pub fn change_gid(&mut self, gid: u32)

pub fn change_user(&mut self, user: &str) -> Result<(), Error>

pub fn change_group(&mut self, group: &str) -> Result<(), Error>

pub fn set_supplementary_gids(&mut self, ids: &[u32])

pub fn keep_supplementary_gids(&mut self)

pub fn set_rlimit(&mut self, kind: i32, cur: u64, max: u64) -> Result<(), Error>

pub fn use_seccomp(&mut self)

pub fn no_new_privs(&mut self)

pub fn use_seccomp_filter(&mut self)

pub fn set_seccomp_filter_tsync(&mut self)

pub fn parse_seccomp_program<P>(&mut self, path: P) -> Result<(), Error>

where P: AsRef<Path>,

pub fn parse_seccomp_bytes(&mut self, buffer: &[u8]) -> Result<(), Error>

pub fn parse_seccomp_filters<P>(&mut self, path: P) -> Result<(), Error>

where P: AsRef<Path>,

pub fn log_seccomp_filter_failures(&mut self)

pub fn use_caps(&mut self, capmask: u64)

pub fn capbset_drop(&mut self, capmask: u64)

pub fn set_ambient_caps(&mut self)

pub fn reset_signal_mask(&mut self)

pub fn run_as_init(&mut self)

pub fn namespace_pids(&mut self)

pub fn namespace_user(&mut self)

pub fn namespace_user_disable_setgroups(&mut self)

pub fn namespace_vfs(&mut self)

pub fn new_session_keyring(&mut self)

pub fn skip_remount_private(&mut self)

pub fn namespace_ipc(&mut self)

pub fn namespace_net(&mut self)

pub fn namespace_cgroups(&mut self)

pub fn remount_proc_readonly(&mut self)

pub fn set_remount_mode(&mut self, mode: u64)

pub fn uidmap(&mut self, uid_map: &str) -> Result<(), Error>

pub fn gidmap(&mut self, gid_map: &str) -> Result<(), Error>

pub fn inherit_usergroups(&mut self)

pub fn use_alt_syscall(&mut self, table_name: &str) -> Result<(), Error>

pub fn log_to_fd(&mut self, fd: OwnedFd, min_priority: i32)

pub fn enter_chroot<P>(&mut self, dir: P) -> Result<(), Error>

where P: AsRef<Path>,

pub fn enter_pivot_root<P>(&mut self, dir: P) -> Result<(), Error>

where P: AsRef<Path>,

pub fn mount<P1, P2>( &mut self, src: P1, dest: P2, fstype: &str, flags: usize, ) -> Result<(), Error>

where P1: AsRef<Path>, P2: AsRef<Path>,

pub fn mount_with_data<P1, P2>( &mut self, src: P1, dest: P2, fstype: &str, flags: usize, data: &str, ) -> Result<(), Error>

where P1: AsRef<Path>, P2: AsRef<Path>,

pub fn mount_dev(&mut self)

pub fn mount_tmp(&mut self)

pub fn mount_tmp_size(&mut self, size: usize)

pub fn mount_bind<P1, P2>( &mut self, src: P1, dest: P2, writable: bool, ) -> Result<(), Error>

where P1: AsRef<Path>, P2: AsRef<Path>,

pub fn disable_multithreaded_check(&mut self)

Disables the check that prevents forking in a multithreaded environment. This is only safe if the child process calls exec immediately after forking. The state of locks, and whether or not they will unlock is undefined. Additionally, objects allocated on other threads that expect to be dropped when those threads cease execution will not be dropped. Thus, nothing should be called that relies on shared synchronization primitives referenced outside of the current thread. The safest way to use this is to immediately exec in the child.

pub fn run<P, S>( &self, cmd: P, inheritable_fds: &[i32], args: &[S], ) -> Result<i32, Error>

where P: AsRef<Path>, S: AsRef<str>,

Forks and execs a child and puts it in the previously configured minijail. FDs 0, 1, and 2 are overwritten with /dev/null FDs unless they are included in the inheritable_fds list. This function may abort in the child on error because a partially entered jail isn’t recoverable.

pub fn run_remap<P, S>( &self, cmd: P, inheritable_fds: &[(i32, i32)], args: &[S], ) -> Result<i32, Error>

where P: AsRef<Path>, S: AsRef<str>,

Behaves the same as run() except inheritable_fds is a list of fd mappings rather than just a list of fds to preserve.

pub fn run_fd<F, S>( &self, cmd: &F, inheritable_fds: &[i32], args: &[S], ) -> Result<i32, Error>

where F: AsRawFd, S: AsRef<str>,

Behaves the same as run() except cmd is a file descriptor to the executable.

pub fn run_fd_remap<F, S>( &self, cmd: &F, inheritable_fds: &[(i32, i32)], args: &[S], ) -> Result<i32, Error>

where F: AsRawFd, S: AsRef<str>,

Behaves the same as run() except cmd is a file descriptor to the executable, and inheritable_fds is a list of fd mappings rather than just a list of fds to preserve.

pub fn run_command(&self, cmd: Command) -> Result<i32, Error>

A generic version of run() that is a super set of all variants.

pub unsafe fn fork(&self, inheritable_fds: Option<&[i32]>) -> Result<i32, Error>

Forks a child and puts it in the previously configured minijail.

Safety

fork is unsafe because it closes all open FD for this process. That could cause a lot of trouble if not handled carefully. FDs 0, 1, and 2 are overwritten with /dev/null FDs unless they are included in the inheritable_fds list.

Also, any Rust objects that own fds may try to close them after the fork. If they belong to a fd number that was mapped to, the mapped fd will be closed instead.

This Function may abort in the child on error because a partially entered jail isn’t recoverable.

Once this is invoked the object is no longer usable, after this call this minijail object is invalid.

pub unsafe fn fork_remap( &self, inheritable_fds: &[(i32, i32)], ) -> Result<i32, Error>

Behaves the same as fork() except inheritable_fds is a list of fd mappings rather than just a list of fds to preserve.

Safety

See fork.

pub fn wait(&self) -> Result<(), Error>

pub fn kill(&self) -> Result<(), Error>

Send a SIGTERM to the child process and wait for its return code.

Trait Implementations

impl Drop for Minijail

fn drop(&mut self)

Frees the Minijail created in Minijail::new. This will not terminate the minijailed process.